EHR & Health Data Systems · Health Data Network / HIE · Structural / no discrete incident
CommonWell Health Alliance
Headline
CommonWell is a nationwide record-exchange network founded by EHR companies, and it is one of the ten federally designated QHINs under TEFCA.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
CommonWell is a nationwide record-exchange network founded by EHR companies, and it is one of the ten federally designated QHINs under TEFCA. When a doctor's EHR checks whether other providers hold records on you and pulls them in, networks like this do the matching and routing. Its privacy policy says its services 'may include the use and transfer of PHI.' Its data and security policy lets the Alliance or a service provider store health data 'for the sole purposes of providing the Services,' without saying what is stored, where, or for how long. Patients have no direct relationship with it and no opt-out mechanism is described: consent is left to the participating providers under applicable law. This pass found no breach or enforcement action.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-15
Primary source. www.commonwellalliance.org/data-and-security/ — Unverified - heuristic first draft.
Terms
Arbitration
None. Website terms give exclusive jurisdiction to Delaware state and federal courts.
Data sharing
Locates and transmits patient records between member EHRs. May store health data and de-identified PHI to provide services. The website collects IP, device and zip-level data and uses cookies, third-party cookies and web beacons.
Fees and billing
None (no consumer billing).
Contacts
Privacy contact. Obfuscated email on privacy page; Contact Us page on commonwellalliance.org
Legal notice. CommonWell Health Alliance, 75 Arlington Street, Suite 500, Boston, MA 02116 (contact-page address; not necessarily the registered agent for service of process)
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Organization homepage · 2026 www.commonwellalliance.org/ | whole row | Unassigned | confirmed | “Supporting connected healthcare through trusted collaboration and data exchange” Quote basis: not recorded. |
| TEFCA RCE · 2026 rce.sequoiaproject.org/designated-qhins/ | whole row | Unassigned | confirmed | “CommonWell Health Alliance” Quote basis: not recorded. |
| Organization privacy policy · 2026 www.commonwellalliance.org/privacy/ | whole row | Unassigned | confirmed | “Alliance's Services may include the use and transfer of PHI” Quote basis: not recorded. |
| Organization data & security policy · 2026 www.commonwellalliance.org/data-and-security/ | whole row | Unassigned | confirmed | “only as necessary to provide or receive the benefit of the Services” Quote basis: not recorded. |
| Organization terms of use · 2026 www.commonwellalliance.org/terms/ | whole row | Unassigned | confirmed | “These Terms of Use will be governed by the laws of the State of Delaware” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.commonwellalliance.org/privacy/ | Not fetched yet | NOT CONFIRMED |
| Terms of service https://www.commonwellalliance.org/terms/ | Not fetched yet | NOT CONFIRMED |
| Website https://www.commonwellalliance.org | Not fetched yet | — |
| Primary source https://www.commonwellalliance.org/data-and-security/ Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for MA